CVE-2023-52974

scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

State: Published
Severity: 7.8 High
Published: Mar 27, 2025
Updated: Aug 5, 2026
Reserved: Mar 27, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsi_session_teardown() while userspace is still accessing the session we will hit a use after free bug.

Set the tcp_sw_host->session after we have completed session creation and can no longer fail.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 496af9d3682ed4c28fb734342a09e6cc0c056ea4Affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 6abd4698f4c8a78e7bbfc421205c060c199554a0Affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before d4d765f4761f9e3a2d62992f825aeee593bcb6b9Affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 9758ffe1c07b86aefd7ca8e40d9a461293427ca0Affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 0aaabdb900c7415caa2006ef580322f7eac5f6b6Affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 61e43ebfd243bcbad11be26bd921723027b77441Affected a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3Affected
LinuxLinux	2.6.39Affected before 2.6.39Not affected 4.14.306 through 4.14.Not affected 4.19.273 through 4.19.Not affected 5.4.232 through 5.4.Not affected 5.10.168 through 5.10.Not affected 5.15.93 through 5.15.Not affected 6.1.11 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 496af9d3682ed4c28fb734342a09e6cc0c056ea4Affected
a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 6abd4698f4c8a78e7bbfc421205c060c199554a0Affected
a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before d4d765f4761f9e3a2d62992f825aeee593bcb6b9Affected
a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 9758ffe1c07b86aefd7ca8e40d9a461293427ca0Affected
a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 0aaabdb900c7415caa2006ef580322f7eac5f6b6Affected
a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before 61e43ebfd243bcbad11be26bd921723027b77441Affected
a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 to before f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3Affected

LinuxLinux

2.6.39Affected
before 2.6.39Not affected
4.14.306 through 4.14.*Not affected
4.19.273 through 4.19.*Not affected
5.4.232 through 5.4.*Not affected
5.10.168 through 5.10.*Not affected
5.15.93 through 5.15.*Not affected
6.1.11 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.